Procedure examples

Aria-body has the ability to identify the titles of running windows on a compromised host.

Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.

Aria-body has the ability to collect data from USB devices.

Aria-body has used an encrypted configuration file for its loader.

Aria-body has the ability to identify the username on a compromised host.

Aria-body has the ability to gather TCP and UDP table status listings.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.

Aria-body has the ability to enumerate loaded modules for a process..

Aria-body has the ability to delete files and directories on compromised hosts.

Aria-body has used HTTP in C2 communications.

Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, and machine GUID on a compromised host.

Aria-body has the ability to gather metadata from a file and to search for file and directory names.

Aria-body has the ability to use a reverse SOCKS proxy module.

Aria-body has used TCP in C2 communications.

Aria-body has the ability to download additional payloads from C2.

Aria-body has the ability to launch files using ShellExecute.

Aria-body has the ability to capture screenshots on compromised hosts.

Aria-body has the ability to duplicate a token from ntprint.exe.

Aria-body has the ability to execute a process using runas.

Aria-body has the ability to decrypt the loader configuration and payload DLL.

Aria-body has established persistence via the Startup folder or Run Registry key.

Aria-body has used ZIP to compress data gathered on a compromised host.

Aria-body has the ability to use a DGA for C2 communications.

Aria-body has the ability to identify disk information on a compromised host.